Help

BI’s Article search uses Boolean search capabilities. If you are not familiar with these principles, here are some quick tips.

To search specifically for more than one word, put the search term in quotation marks. For example, “workers compensation”. This will limit your search to that combination of words.

To search for a combination of terms, use quotations and the & symbol. For example, “hurricane” & “loss”.

Login Register Subscribe

Workplace IT risks getting personal

Letting employees use own laptops for work invites new exposures

Reprints

More employees are using their own laptop computers at work, a trend that employers should approach with considerable caution, observers warn.

Concerns about establishing boundaries between personal and company information, protecting company networks against viruses and malware that may infect workers' computers, and retrieving vital company data when the employee leaves the firm are just a few issues with which employers must contend, observers say.

“There is an incredible range of issues that would be hugely problematic” in using employees' personal computers, said Michael R. Overly, a partner with law firm Foley & Lardner L.L.P. in Los Angeles.

A survey by Stamford, Conn.-based Gartner Inc. found that the average number of workers using their own laptops as their primary work computer is expected to increase to 14% in mid-2010 from 10% this year, and many believe this trend will continue.

Cost is one factor. Gartner Research Director Annette Jump said company acceptance of such an arrangement varies greatly. “In the current climate of cost containment, large enterprises are exploring all possibilities offered by alternative client computing architectures and device solutions, and that includes employee-owned PCs,” she said in a statement.

Some employees also prefer to use their own computers because they have better hardware specifications and a newer design, according to the second-quarter survey of 528 information technology managers in the United States, United Kingdom and Germany.

“You need to consider what the risks are associated with (employee ownership of work computers) and weigh that with the cost savings,” said Lisa J. Sotto, a partner with law firm Hunton & Williams L.L.P. in New York.

It is critical that employers establish policies on this issue, observers say.

Unregulated computer usage “is an invitation to all manner of mischief,” said Brian T. Ashe, a partner with law firm Seyfarth Shaw L.L.P. in San Francisco.

Before permitting employees to bring in their own computers, firms must have in place “a very sound written policy and some mechanisms of enforcing that policy through their IT department” to adequately manage security issues, Mr. Ashe said.

One major security concern is viruses and malware.

“It's a tough task for any network to keep its system clean from that kind of malware,” said Randy Gainer, a partner with law firm Davis Wright Tremaine L.L.P. in Seattle. Personal computers can be used “for a lot of different things, including surfing the Web and sites embedded with viruses and Trojan horses intended to steal personal data,” that can infect the company network.

Scott L. Vernick, a partner with law firm Fox Rothschild L.L.P. in Philadelphia, said, “It's not that you don't have some of the same issues when your employees use laptops, as opposed to semifixed work stations, but at least presumably the employer has an auditing protocol” or other measures so the firm knows when it is under attack by a virus or malware.

Software is available to help the employer's network defend itself, but firms also must educate their employees to exercise good “security hygiene,” Mr. Gainer said.

Other issues that must be addressed include what happens if the computer needs servicing, said Foley & Lardner's Mr. Overly. There must be controls in place “so very sensitive (company) data is protected,” he said of cases where employees handle their own servicing and repairs.

Supervision is another issue.

Some companies like to monitor their employees' computer use to evaluate their productivity, said David Gevertz, a shareholder with law firm Baker, Donelson, Bearman, Caldwell & Berkowitz P.C. in Atlanta.

This gets a “little more complicated” if the employer does not own the computer, and may require installation of software “that may or may not be compatible with the company's server or mainframe,” said Mr. Gevertz. “It's also a little bit easier for the employee to temporarily disable that kind of software, if they can take it home and do what they will with it.”

Protection of the employee's personal data also is an issue.

“You have the problem of what happens if you have a disruption or corruption of an employee's own data by the company,” which could include tax and bank records, said Mr. Overly.

While companies “are very good at protecting their own information,” they are “generally not good at worrying about other information they don't want and don't need and yet is now on their premises,” he said.

Litigation is another concern, said Mr. Ashe. If the home computer is sought in discovery, “the hard drive would have to be produced in the litigation,” which means the employee's private data “would be snooped through and looked at by third parties,” including the employer, judges and forensic computer experts. “That's a danger for employees that many don't consider until they are stuck in the litigation scenario,” he said.

Mr. Vernick said employees have “got to understand they've got to give up, potentially, some degree of privacy because...what was once private may not be private” when they use their personal computers at work.

Mr. Gevertz said one solution would be to give the employee funds to purchase the computer but require that it is dedicated solely to work.

Another possible issue is if the computer does not conform to nationally recognized ergonomic standards and a workplace injury results, said Mr. Overly. “Who's responsible? The employer hasn't made a specific decision about the hardware,” yet could face a work-related claim.

Employers also must plan for when an employee leaves the company.

If there is company data on the employee-owned PC, “what is the process for removing that information at the time of separation?” said Katharine H. Parker, a partner with law firm Proskauer Rose L.L.P. in New York.

Firms “that allow employees to use their own computers should really be thinking about changing their polices to make sure when employees depart, all the company and client data comes back to the company, and it's securely wiped,” said Gabriel M. Helmer, an associate with law firm Foley Hoag L.L.P. in Boston.